OS2World OLD-STATIC-BACKUP Forum

OS/2 - Technical => Internet => Topic started by: ddan on 2008.09.27, 04:47:53

Title: Clickjacking!
Post by: ddan on 2008.09.27, 04:47:53
The newest FEATURE EXPLOIT: Clickjacking! Seems to be a hidden frame, enabled
by Flash:
http://blogs.zdnet.com/security/?p=1972

But this blog seems to have the most info:
── ── ── ── ── ── ── ── ── ── ── ── ── ── ── ── ── ──
http://www.webadminblog.com/index.php/2008/09/24/new-0day-browser-exploit-clickjacking-owasp-appsec-nyc-2008/

zmjjmz  |  September 26th, 20088 at 2:28 pm
Ok guys, so, supposedly the NoScript dude has a fix to this. (Assuming you
have FF and NoScript installed) You would go to Tools, Add-ons, Extensions,
NoScript, Preferences, and then the Plugins tab.
Check off "Forbid " and (according to the NoScript maintainer) you should be
100% protected.
── ── ── ── ── ── ── ── ── ── ── ── ── ── ── ── ── ──

Oh, rats! I'd already done that! Turns out that my policy of forbidding
plug-ins and avoiding "features", especially Flash which is said to have the
flaw here, made me safe from attacks that hadn't been invented.

Darn! Now I don't get that warm and fuzzy glow as Windows types get when after
fixing one flaw, they await the next to be discovered. (To be fair, even with Windows,
MOST security problems are due to UNNECESSARY FEATURES.)